Hello and welcome to the presentation of our paper which is modeling memory for individual
re-identification in decentralised mobile contact tracing applications.
So in this paper we focused on mobile contact tracing applications, so MCTA,
which have been proposed as a possible solution to contain the pandemic, as they notify users
when being in contact with a positive user, in order to be eventually tested.
So there were roughly 4 different proposals, either with BLE or GPS,
and either distributed or centralized.
In this work we focus we focus on BLE MCTA either distributed or centralized.
So when mobile contact tracing applications were proposed there have been a lot of privacy concerns
about the possible identification of individuals,
possible identification of locations, data leak etcetera.
So even though those problems have been partially solved, in this work we present a novel attack
which is based on the memory of the individuals.
So the main idea that we explore is that each person may actually remember people and places
and if they are able to correlate those memories with codes from the mobile contact
tracing application they are actually able to understand who is the positive individual
which is responsible for their notification from the mobile contact tracing application.
We modelled the problem as a graph in which we have different time windows,
and these are the time windows identified by the mobile contact tracing application
and in each time window you listen for codes and you can receive 0 or more.
So apart from that, we also modelled the memory of the individuals as the ability to remember people
and places, and we leverage work from literature on this, and we also are able to prune the graph
based on invalid connections, and we can do that with 3 possible operations so basically we can
identify positives in a graph when the number of people remembered in a certain time window
is equal to the number of codes that you received, the same can be done for negatives, of course you
have to invert them, and when you do that it is also possible to prune edges so basically when
you are able to identifiy positives and negatives you can simplify the graph,
because you can remove possible connections which are not valid anymore, for instance if you
identify some negative people they cannot have any code associated with them and so on and so forth.
Apart from that we also identified 3 possible mitigation techniques. The first
one is to use a variable time window basically reducing the information sent by the server.
The second one is to inject fake contacts or send multiple reports at once, and the third
one is to use a variable contact tracing range based on the sociability of the individual,
although this reduces the precision of the contact.
So we used two real datasets, they are very similar, the only
meaningful difference for us is that the Copenhagen dataset
also reports the RSSI between individuals while the Social Evolution doesn't.
We applied the graph modelling that I just showed to Copenhagen and Social Evolution and what is can
be seen is that it is really easy to identify contacts based on
current MCTA, regardless of the density and regardless of the dataset.
Then we evaluated our mitigation techniques, here we evaluated the variable time window. On the left
part of the slide you have the identification probability with a variable data length,
so this is basically the amount of data which the server reports to users
to check whether they have been in contact with a positive individual,
and of course if you report more data users are able to prune more edges in the graph
opposed to sending less data which is more privacy preserving and also
adding more users to the report also limits the possibility to identify users, because basically
if you send only one user then all the codes that you receive are referring to that specific users.
If you send more users then you cannot correlate positive codes among them.
Fake contact injection doesn't work really well, basically because you simply skip it,
so if you can't associate it with a user then you simply go on with the other ones.
And for the variable contact range, this is just shown for Copenhagen as I said because for Social
Evolution we don't have the RSSI information, the outcome here is that the more social you are
the better it is, so of course social means how many users you have around you,
and to increase this value the easiest way to do so is to reduce the RSSI threshold, so you can
actually listen to more people, but of course this also reduces the precision of the MCTA.
So to conclude we identified a novel attack on mobile contact tracing application based
on the memory of the individual and we have shown that this attack is indeed possible
also with the use of real datasets, and among the three mitigation techniques we proposed certainly
the first one and the last one are the most effective, as the sociability has a huge impact
on the possibility to identify users, and also the amount of data which is provided, because of
course if you provide less data to the MCTA this may suffice to identify a positive contact, but
it doesn't disclose too much. This is also one of the easiest techniques to implement in real MCTA.
So this is the conclusion, I thank you and I'll take questions if there's any.